Contact Us:
MoD – Def Stan Level 1
Def Stan 05-138 Cyber Security Profile Level-1
MoD DSC Model (CSMv4), Cyber Security Profile Level-1
Def Stan 05-138 Level 1 (Foundational) is normally assigned to suppliers assessed as presenting a low to moderate level of cyber risk when delivering contracted outputs. Level 1 comprises 101 cyber security controls and requires organisations to demonstrate a comprehensive cyber security programme supported by good security practices. The standard adopts a whole-organisation approach, requiring suppliers to protect their corporate environment, including people, systems, processes, infrastructure and data. Its requirements extend beyond information supplied directly by the MOD and are intended to strengthen the supplier’s overall cyber resilience and ability to maintain business operations.
The controls address four key objectives: managing security risks, protecting against cyber attacks, detecting cyber security events and minimising the impact of security incidents. They include establishing security policies and responsibilities, assessing and managing risks, maintaining asset inventories, controlling user access, applying secure system configurations, managing vulnerabilities and security patches, protecting data, and providing appropriate staff security awareness training.
Level 1 also requires organisations to undertake regular vulnerability scanning, conduct annual penetration testing of relevant externally facing systems, maintain appropriate security monitoring and logging, and establish incident response and business continuity arrangements. Organisations must ensure that controls are documented, implemented and supported by auditable evidence. Level 1 therefore provides a structured foundation for managing cyber risk and protecting defence supply chains.
Def Stan 05-138 Level 1 (‘Foundational’) – 101 controls
| ControlID | Control Name | Control Requirement |
|---|---|---|
| 1 | Cyber Essentials | The Supplier shall have Cyber Essentials certification that covers the scope required for all aspects of the contract and commit to maintaining this for the duration of the contract. |
| 1100 | Governance | The Supplier shall have appropriate management policies and processes in place to govern their approach to the security of the network and information systems supporting Functions and protection of Data. |
| 1102 | Roles and responsibilities | The Supplier shall have established roles and responsibilities for the security of networks and information systems at all levels, with clear and well-understood channels for communicating and escalating risks. |
| 1200 | Risk management | The Supplier shall take appropriate steps to identify, assess, understand and remediate security risks to the network and information systems that protect all Data. This includes an overall organisational approach to risk management. |
| 1202 | Periodically assess risk | The Supplier shall periodically assess the risk to organisational operations (including mission, functions, image, or reputation), organisational assets, and individuals, resulting from the operation of organisational systems and the associated processing, storage, or transmission of Data. |
| 1203 | Network diagrams | The Supplier shall create and maintain up to date network diagrams detailing the network boundaries, internal and external connection, and systems within the operational environment. |
| 1300 | Asset management | The Supplier shall reasonably ensure everything required to deliver, maintain or support networks and information systems that support delivery of all Functions which protect all Data are determined and understood. This includes people and systems, as well as any supporting infrastructure (such as power or cooling). |
| 1400 | Supply chain | The Supplier shall understand and manage security risks to Functions and Data that arise as a result of dependencies on external suppliers. This includes ensuring that appropriate measures are employed where third party services are used. |
| 1401 | External provider trusted relationships | The Supplier shall establish, document, and maintain trust relationships with external service providers based on the following requirements, properties, factors, or conditions: security and privacy requirements, properties, factors, or conditions defining acceptable trust relationships. |
| 1500 | Physical access controls | The Supplier shall, unless prohibited by applicable law, restrict and monitor all physical access to facilities where Data is stored or processed to its authorised Personnel by implementing industry standard physical access controls. Examples of such controls include but are not limited to: i) Swipe card technology ii) Monitored CCTV iii) Remotely monitored alarm systems iv) On-premise security guards v) Photographic access credentials vi) Visitor escort vii) Physical access logs viii) Authorised access lists. The Supplier shall review physical access logs regularly or in the event of a physical or cybersecurity incident. |
| 1501 | Physical access device management | The Supplier shall manage and maintain an inventory of all physical access devices used on their premises. The inventory should contain a unique identifier for the device regardless of the type (e.g. RFID card, access fob or door key) as well as the named individual who it is assigned to. |
| 1502 | Physical access restrictions | The Supplier shall restrict physical access to sensitive areas within an organisation’s premises to only those who are authorised to have access. The Supplier shall maintain and manage an inventory of those staff who have privileged physical access. |
| 1503 | Visitor access management | The Supplier shall ensure the following controls are applied to all visitors visiting the organisation’s premises: i) Visitor access and exit shall be logged ii) All visitors shall wear visitor ID badges at all times. Visitor badges should visually differ from employee badges iii) All visitors should be appropriately escorted at all times while on the premises iv) Visitor badges should be returned to the organisation at the end of the day. |
| 2100 | Resilience policy and process development | The Supplier shall develop, enact and regularly review cyber security and resilience policies and processes to manage and mitigate the risk of adverse impact on Functions and protection of Data. |
| 2200 | Identity and access control | The Supplier shall understand, document and manage (i.e create, review and disable) access to networks, information systems, and removable storage media & devices supporting Functions and protection of Data. All accounts and identities, including users, system and automated functions that can access Data or systems are appropriately verified, authenticated and authorised. |
| 2204 | Principle of least functionality | The Supplier shall ensure that all information systems are configured to provide only essential capabilities and to prohibit or restrict the use of non-essential functions, such as ports, protocols, programmes and services that are not integral to the operation of that information system. |
| 2205 | Least privilege | The Supplier shall closely manage all user accounts and employ the principle of least privilege to networks and information systems supporting all Functions and protecting all Data. |
| 2206 | Least privilege – audit system | The Supplier shall limit access to systems’ audit/security logging data and functionality to privileged user groups that have a confirmed requirement in accordance with the principle of least privilege. |
| 2207 | Separation of duties | The Supplier shall develop a policy and implement a separation of duties methodology for standard and privileged accounts which support Functions and protect Data. |
| 2210 | Limit to authorised transactions | The Supplier shall issue, manage, verify, revoke, and audit identities and credentials to authorised transactions. users, and processes. |
| 2211 | Secure first-time password management | The Supplier shall employ secure practices for the secure storage, transmission, and management of first-time and one-time passwords. These practices include, but are not limited to: i) Secure storage of first-time password prior to use ii) Secure transmission of first-time and one-time passwords to their new user iii) Require first-time and one-time passwords are immediately changed after first logon. |
| 2213 | Automated password quality check | The Supplier shall deploy technical controls to manage the quality of credentials across all identifiers. The technical controls should reflect industry standard requirements such as password length, complexity requirements (e.g. uppercase, lowercase, numbers and symbols), reuse history, prevent reuse of identifiers for a defined period, banned words and insecure pattern recognition (e.g. 1234), as appropriate. |
| 2214 | Repeated unsuccessful logon handling | The Supplier shall employ policies and processes to appropriately manage unsuccessful login attempts to standard and privileged accounts. The Supplier shall lock accounts after at most ten unsuccessful login attempts for a minimum of 15 minutes; the duration of which should increase between multiple account lockouts. |
| 2215 | Replay-resistant authentication | The Supplier shall enforce technical control to protect against the capture of transmitted authentication or access control information and its subsequent retransmission i.e replay attacks. |
| 2217 | Service accounts | The Supplier shall inventory all generic, service and system accounts used on the network. Every account shall be owned by a single named individual who is responsible and accountable for the account and its usage. |
| 2218 | System users and processes | The Supplier shall identify system users, processes acting on behalf of users, and devices. |
| 2300 | Data security | The Supplier shall appropriately protect data stored or transmitted electronically from actions such as unauthorised access, modification, or deletion that may cause an adverse impact on Functions or Data. Such protection extends to how authorised users, devices and systems access critical data necessary for the operation of Functions and use of Data. Additionally, covers information that would assist an attacker, such as design details of networks and information systems. |
| 2303 | Management of established network connections | The Supplier shall terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity. |
| 2304 | Wireless network access control | The Supplier shall ensure that the following controls apply to trusted organisational wireless networks: i) All users and devices must be authorised and authenticated prior to granting access to the network via the wireless network ii) The data transferred over the wireless network must be encrypted using WPA2 or above methodology. |
| 2305 | Remote Access – VPN (Virtual Private Network) | The Supplier shall ensure the following controls are enforced for staff to connect to organisational networks and systems using Remote Access technologies, for example VPN: i) Enable MFA prior to establishing a remote connection to the network ii) Encrypt all data transmitted over a VPN connection iii) Disable split-tunnelling to ensure all Data is only transmitted via organisation controlled channels. |
| 2306 | Remote access sessions | The Supplier shall employ cryptographic mechanisms to protect the confidentiality of remote access sessions. |
| 2307 | Managed access control points | The Supplier shall route remote access via managed access control points. |
| 2310 | Removable media | The Supplier shall: i) Maintain and manage an inventory of corporately owned removable storage media and devices ii) Encrypt removable media using secured and industry best practice methods iii) Allow only corporately owned and/or authorised removable storage media and devices to have read/write permissions iv) Prohibit the use of removable storage media and devices that are not corporately owned or authorised. |
| 2311 | Authorised working locations | The Supplier shall maintain and update a list of authorised working locations which are not the organisation’s premise and communicate these locations to all employees and contractors. |
| 2312 | Security at alternate working locations | The Supplier shall employ technical security controls and educate users to reduce the security risks to employees while working outside the organisation’s premise. Technical security controls for consideration may include, but are not limited to: i) Always-on VPN to protect data in-transit ii) Screen privacy protector to prevent shoulder surfing iii) Disabling USB ports on devices iv) Full disk encryption User awareness topics may include, but are not limited to: i) Risks of using public Wi-Fi ii) Avoid taking confidential phone calls within earshot of unauthorised individuals iii) Shoulder surfing iv) Avoid leaving devices unattended |
| 2314 | Ensure UK GDPR compliance | The Supplier shall ensure that the processing of personal data is conducted in compliance with the General Data Protection Regulation. |
| 2315 | Email authentication methods | The Supplier shall implement Domain-based Message Authentication, Reporting and Conformance (DMARC), DomainKeys Identified Mail (DKIM) and Sender Policy Framework (SPF) to verify the authenticity of an email’s source. |
| 2316 | Personal and/or Personally Identifiable Information (PII) processing/transparency – control flow | The Supplier shall employ systems to monitor and control the flow of all Personal and/or Personally Identifiable Information (PII) and all government information (e.g. OFFICIAL and above) provided or produced during the contract throughout the information lifecycle in accordance with approved authorisations, required legislation and contractual requirements. |
| 2317 | Endpoint encryption | The Supplier shall implement and maintain full disk level encryption on all endpoints to industry standard solutions, for example, full disk encryption solutions using AES-256 encryption algorithm or FIPS equivalent. |
| 2318 | Approved cryptographic methods | The Supplier shall employ appropriate nationally or departmentally approved cryptography when used to protect all Data (e.g. FIPS 140-2 or comparable standards) |
| 2319 | Securely manage cryptographic keys | The Supplier shall establish and manage cryptographic keys for cryptography employed in organisational systems using appropriate nationally or departmentally approved solutions (e.g. FIPS 140-2 or comparable standards) |
| 2321 | Publicly accessible data | The Supplier shall: i) Designate individuals authorised to make information publicly accessible ii) Train authorised individuals to ensure that publicly accessible information does not contain non-public information iii) Review the proposed content of information prior to posting onto the publicly accessible system to ensure that non-public information is not included iv) Periodically review the content on the publicly accessible system for non-public information and remove such information, if discovered. |
| 2322 | Mobile devices/Bring Your Own Device (BYOD) | The Supplier shall ensure that mobile devices accessing its corporate environment/data are appropriately configured and managed using industry recognised solutions such as Mobile Device Management (MDM) tooling. |
| 2323 | Secure destruction | The Supplier shall, where not otherwise stated explicitly by country, legislation or Authority instructions, implement procedures to ensure that all Data is securely destroyed when no longer needed, or at the expiration or termination of the Agreement. Supplier shall: i) Secure and confirm the erasure of Data from its systems and servers, including any physical or electronic copies, prior to asset destruction and disposal ii) Provide attestation of destruction, where specified by contract with Authority iii) Require that any third parties engaged to process the Data shall securely dispose of such Data when no longer needed to provide the service, unless otherwise stated explicitly by country, legislation or Authority instructions. |
| 2400 | System security | The Supplier shall ensure that network and information systems and technology critical for the operation of business Functions and protection of Data are protected from cyber attack. An organisational understanding of risk to business Functions and protection of Data informs the use of robust and reliable protective security measures to effectively limit opportunities for attackers to compromise networks and systems. |
| 2401 | Secure configuration | The Supplier shall securely configure the network and information systems that support the operation of business Functions and that protect Data. |
| 2402 | Vulnerability management | The Supplier shall implement a vulnerability and patch management process to identify, report, and remediate application and system (internal and external facing) vulnerabilities that is approved by the application or system owner and is commensurate with the level of risk by: i) Performing vulnerability scans on a monthly basis and during any major system or application updates ii) Implementing vendor patches or fixes prioritising using the CVSS v3 scoring iii) Developing a Risk Treatment Plan to address identified vulnerabilities. The Supplier shall address vulnerabilities in accordance with the Supplier’s internal vulnerability remediation timelines and in line with reasonable industry standards for vulnerability management based on CVSS v3 or above. |
| 2403 | Penetration testing | The Supplier shall conduct penetration testing (minimum every 12 months) against externally facing systems used to support the operation of Functions and that protect Data. The penetration testing programme shall be based upon industry standards and performed by subject matter experts. The Supplier shall ensure that any deficiencies identified are remediated in a timely manner in line with their risk to the network. The Supplier shall retain records including: i) The scope and methodology utilised ii) The number of critical, high, and medium severity findings iii) The name of the tester iv) The date of the testing v) Timelines and actions for a remedial plan. |
| 2404 | Change management | The Supplier shall formally document, publish and review (minimum every 12 months) the change control procedures to manage changes to information systems, supporting infrastructure and facilities. The change management policy includes: i) Definitions of the types of change (e.g. standard, critical, emergency) with associated processes ii) Roles and responsibilities for those involved in the change or approving the change. Prior to implementing any changes, Supplier shall: i) Establish acceptance criteria for production change approval and implementation ii) Require stakeholder approval prior to any change implementation iii) Formally record the change in a centralised repository iv) Document business impact analysis outcomes and document back-out procedures should the change fail v) Keep a full audit trail of the change request, testing conducted, associated documentation, approvals and outcomes vi) Document and record security impact analysis outcomes along with any mitigating actions. |
| 2405 | Patch management | The Supplier shall develop and maintain an appropriately robust patch management programme to address known vulnerabilities on its network within industry best-practice timelines. The Supplier shall take appropriate steps to identify, assess, test and implement patches for endpoints, network devices and software which address known vulnerabilities within industry best practice timeline. The Supplier shall have appropriate processes in place to address out-of-band emergency patching and/or mitigating actions. |
| 2407 | Privacy warning notices – specific handling | The Supplier shall ensure that users accept appropriate warning notices prior to information system access where information systems contain information with specific handling requirements imposed by the UK or its International Partners. Such warnings must only be provided to authenticated users. At a minimum users must be warned that: i) The information system contains information with specific requirements imposed by the UK and/or international partner nations. ii) Use of the information system may be subject to other specified requirements associated with certain types of information, such as that subject to Export Controls or licences. |
| 2408 | Screen locking/timeouts | The Supplier shall have controls in place to automatically lock user sessions after a predefined period. The lock screen shall conceal all information previously displayed on the screen and prevent unauthorised viewing of data. |
| 2409 | Identify allowed programs | The Supplier shall identify software programs authorised to execute on the corporate environment. For all other programs employ a block by default, permit-by-exception policy. |
| 2410 | Review the list of approved software | The Supplier shall review and manage the list of authorised software programs at least every 90 days. |
| 2411 | Secured Internet access | The Supplier shall ensure the following internet controls are enforced on endpoints: i) Technical controls to prevent malware infection from internet browsing are in place ii) Block undesirable websites from being accessed (e.g. malicious sites, inappropriate content etc.) iii) Prevent code being launched on the corporate host iv) Prevent downloads to the corporate host from the internet without sandboxing and anti-malware scan v) Automatically block suspicious traffic and communications vi) Terminate network connections associated with communications sessions at the end of the sessions or after a defined period of inactivity. Ensure auditing is enabled for these controls and security operators are notified of the attempted above actions. Where users have a necessity to perform the above activities, ensure a robust model and supporting processes and technologies are employed to mitigate the additional risk (e.g. allow/block listing, network monitoring, vulnerability scanning etc.) |
| 2412 | Voice over Internet Protocol (VoIP) | The Supplier should establish usage restrictions and implementation guidance for Voice over Internet Protocol (VoIP) technologies based on the potential to cause damage to the information system if used maliciously; and ensure controls are in place to authorise, monitor, and control the use of VoIP within the information system. |
| 2413 | Mobile code management | The Supplier shall define acceptable and unacceptable mobile code, and ensure controls are in place to identify, authorise, monitor, review and control the use of mobile code within the organisation. |
| 2414 | Communication authenticity protection | The Supplier shall use secure network management and communication protocols to protect session authenticity addressing communications protection at the session level. |
| 2417 | Authorise remote execution of privileged commands | The Supplier shall ensure that all remote users acquire appropriate authorisation prior to accessing and/or executing privileged functions. |
| 2418 | Baseline configurations and inventories | The Supplier shall implement, update and document system hardening procedures. Implement, update and document baseline configurations settings for all information technology products deployed in organisational systems; this shall include the restriction of user actions and of unsupported software and hardware. |
| 2419 | Obscure authentication information | The Supplier shall configure systems to obscure authentication information, for example, passwords to ensure that they are not displayed as cleartext when a user is inputting their credentials. |
| 2420 | Authentication feedback | The Supplier shall configure systems to minimise feedback information from failed logons to ensure that the system does not provide any information that would allow unauthorised individuals to compromise authentication mechanisms. e.g. explicitly stating that the password is the incorrect authentication component. |
| 2421 | Network Time Protocol (NTP) | The Supplier shall implement a Network Time Protocol (NTP) to a recognised authoritative source, to synchronise the clocks of every network device to ensure accurate and consistent timestamps for audit records on associated system logs. |
| 2422 | Physical and logical access restrictions | The Supplier shall define, document, approve, and enforce physical and logical access restrictions associated with changes to organisational systems. |
| 2423 | Trusted source repository | The Supplier shall identify, register and maintain an inventory of system components using automated tooling for those assets that support business Functions and protect Data in an asset register, and at a minimum, include data location and asset ownership information. |
| 2426 | Anti-malware capabilities | The Supplier shall ensure that anti-malware capabilities are regularly audited, to verify they are up to date, functional (e.g. performing real-time scans as well as periodic scans), managed, detect malware, report detections and update both malware signatures and software when new releases are available. |
| 2427 | Monitor/protect communications at boundaries | The Supplier shall monitor, control, and protect communications (information transmitted or received by organisational systems) at the external boundaries except as prohibited by Applicable Law and key internal boundaries of those organisational systems. This includes all staff including all remote workers to carry out their duties. |
| 2428 | Verify/limit access to external system connections | The Supplier shall control and limit connections to external systems by an allow-list on the network boundary. |
| 2429 | Verify/limit access from external system connections | The Supplier shall block unauthorised inbound connections by default. Inbound firewall rules are approved and documented by an authorised person, and include the business need within the documentation. |
| 2500 | Resilient networks and systems | The Supplier shall build resilience against cyber-attack and system failure into their design, implementation, operation and management of systems that support the operation of business Functions and protection of Data. |
| 2501 | Design for resilience | The Supplier shall design the network and information systems supporting their Functions and protect Data to be resilient to cyber security incidents and system failure. Systems shall be appropriately segregated and resource limitations mitigated. |
| 2502 | Resilience preparation | The Supplier shall develop recovery plans for all systems that deliver Functions and protect Data. |
| 2504 | Backups | The Supplier shall hold accessible and secured current backups of data and information needed to recover operation of their Functions and protect Data. Backup procedures and media shall include: i) Appropriate encryption technology ii) Integrity validation. |
| 2507 | Deny traffic by default at interfaces | The Supplier shall ensure that firewalls must block every network connectivity path and network service not explicitly authorised by the appropriate Change Advisory Board (CAB). Traffic flow policy exceptions that are no longer supported by an explicit business need must be removed. |
| 2508 | Separate public and internal subnetworks | The Supplier shall implement network segmentation for publicly accessible system components to ensure logical and/or physical separation from internal network components. |
| 2509 | Managed email filtering | The Supplier shall implement appropriate tooling or methods to detect, block and report malicious or spam emails coming into the network. Such tooling or methods may include learning capabilities for more effectively identifying legitimate communications. |
| 2510 | Diagnostic programmes | The Supplier shall check all media containing diagnostic and/or test programs for malicious code prior to use on the organisational network. |
| 2511 | Maintenance activities | The Supplier shall ensure that relevant good practice tooling, techniques and mechanisms are authorised or provided to maintenance personnel in order to carry out their duties |
| 2512 | MFA for remote maintenance activities | The Supplier shall require multi-factor authentication to establish non local maintenance sessions via external network connections and terminate such connections when nonlocal maintenance is complete. |
| 2513 | Maintenance personnel supervision | The Supplier shall designate authorised, suitably qualified and experienced personnel to supervise maintenance personnel who do not possess the required physical access authorisations. |
| 2600 | Staff awareness and training | The Supplier shall ensure that staff have appropriate awareness, knowledge and skills to carry out their organisational roles effectively in relation to the security of network and information systems supporting the operation of business Functions and protection of Data. |
| 2603 | Staff risk awareness | The Supplier shall ensure that managers, systems administrators, and users of organisational information systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of organisational information systems. The Supplier shall review and update these security risks at least every 12 months or when there is significant change within the organisation or threat. |
| 2604 | Acceptable Use Policy | The Supplier’s Acceptable Use Policy shall consider and include appropriate enforcement of restrictions on: i) Use of social media, social networking sites, and external sites/applications ii) Posting organisational information on public websites iii) Use of organisation-provided identifiers (e.g. email addresses) and authentication secrets (e.g. passwords) for creating accounts on external sites/applications iv) Enforce clear desk and clear screen requirements v) Handling of physical corporate assets outside the office environment vi) Locations for conducting duties vii) Remote activation of collaborative computing devices viii) Prohibit remote activation of collaborative computing devices and provide indication of devices in use to users present at the device. |
| 2700 | Personnel pre-employment checks | The Supplier shall, unless prohibited by Applicable Law, perform appropriate background verification checks on Personnel that have access to Data upon hire. The verification checks shall include: i) Verifying credentials ii) Employment history iii) Qualification checks iv) Application or verification of BPSS (Baseline Personnel Security Standard) |
| 2701 | Personnel security vetting* | The Supplier shall define and implement a policy for applying BPSS and National Security Vetting (NSV) checks as appropriate for employees that support Functions and the protection of Data. *(It is recognised that application of NSV is normally only possible once a contract requiring such is in place. Potential suppliers who do not meet this requirement at time of submission must, however, be willing and be able to enforce their staff through appropriate levels of vetting within a timescale agreed with the project delivery team following contract award). |
| 2702 | Joiners, movers and leavers | The Supplier shall define and implement a joiners, movers and leavers policy to secure organisational hardware, software and systems. |
| 2703 | Whistleblowing | The Supplier shall define and implement training and processes for employees and contractors to identify and report suspicious activities and/or behaviour including violations of information security policies and procedures without fear of recrimination. The Supplier shall define and implement a disciplinary process to take action against employees who violate information security policies or procedures. |
| 2704 | Environmental controls | The Supplier shall, where appropriate, implement, install, and maintain the following environmental controls supporting Functions and protection of Data: i) Fire suppression systems ii) Temperature and humidity controls within a data centre or server room environment iii) Backup power technology (e.g. uninterruptible power supply, diesel generator, separate grid connection, etc.). |
| 3100 | Security monitoring | The Supplier shall monitor the security status of the networks and systems supporting the operation of business Functions and protection of Data in order to detect potential security problems and to track the ongoing effectiveness of protective security measures. |
| 3101 | Monitor security controls | The Supplier shall establish and document security event monitoring which at a minimum covers the following: i) Security events covered ii) Frequency of monitoring iii) Clearly defined roles and responsibilities iv) Escalation matrix. |
| 3107 | Create, retain and correlate audit logs | The Supplier shall generate event logs for systems that support the operation of Functions and protection of Data. The following criteria apply: i) Logs are archived for a minimum of 12 months ii) Logs capture (as a minimum) date, time (from a single NTP source), user ID, device accessed and port used iii) Logs capture key security event types (e.g. critical files accessed, user accounts generated, multiple failed login attempts, logging failures from devices, events related to systems that have an internet connection) iv) Access to modify system logs is restricted v) Logs and security event logs can be made available upon request vi) Store audit records in a repository that is part of a physically different system vii) The Supplier shall ensure that systems logs are reviewed at least weekly to identify system failures, faults, or potential security incidents and corrective actions are taken to resolve or address issues within a reasonable timeframe viii) Review, at least every 6 months the event types selected for logging purposes to ensure these still meet business requirements ix) Capture the operational status of the logging system and alert on any failures which impact the system’s operational capacity. |
| 3108 | Audit reduction and report generation | The Supplier shall provide and implement an appropriate audit record reduction and report generation capability that: i) supports on-demand audit record review, analysis, and reporting requirements and after-the-fact investigations of incidents; and ii) does not alter the original content or time ordering of audit records. |
| 3109 | Integration of records with incident management | The Supplier shall integrate audit record review, triage, analysis, and reporting processes with organisational governance and incident management structure. |
| 3200 | Proactive security event discovery | The Supplier shall detect, within networks and information systems, malicious activity affecting, or with the potential to affect, the operation of business Functions and protection of Data even when the activity evades standard signature-based security prevent/detect solutions (or when standard solutions are not deployable). |
| 3201 | System abnormalities for attack detection | The Supplier shall define examples of abnormal system behaviour to aid in detecting malicious activity that is otherwise hard to identify. The Supplier shall take appropriate action upon identifying this behaviour. |
| 3203 | Use indicators of compromise from alerts | The Supplier shall monitor system security alerts and advisories and take action in response using agreed and managed indicators of compromise. |
| 3204 | Presence of unauthorised system components | The Supplier shall implement proportionate measures to: i) Detect the presence of unauthorised hardware, software, and firmware components within the system using tooling ii) Take the following actions when unauthorised components are detected: disable network access by such components; isolate the components; notify systems administrators and/or security operations teams. |
| 4100 | Response and recovery planning | The Supplier shall implement well-defined and tested incident management processes that aim to ensure continuity of business Functions and protection of Data in the event of system or service failure. Mitigation activities are designed and where possible automated to contain or limit the impact of a compromise. |
| 4104 | Incident handling capability | The Supplier shall establish an operational incident handling capability for organisational information systems that is consistently applied across the organisation and includes: i) Adequate preparation, detection, forensic analysis, containment, recovery, and user response activities ii) Tracking, documenting, and reporting incidents to appropriate organisational officials and/or authorities iii) Sufficient rigour, intensity and scope. |
| 4106 | Attempted unauthorised connections from staff | The Supplier shall audit the identity of internal users associated with denied communications. |
| 4200 | Lessons learned | The Supplier shall, when an incident occurs, incorporate root cause analysis and lessons learned information from incident response activities into incident response procedures, training and testing. The Supplier shall implement the resulting improvements immediately or, at minimum, within 30 days of the completion of the root cause analysis. |
